- Shipped
- November 15, 2026 at 12:55 AM UTC
- Author
- Kamo
- Commit
- 01ba349
Members with an authenticator could not sign in on the normal page: /api/login answered mfaRequired + mfaToken and the page showed it as a red error under the password with no way on. - The page now opens the existing MfaStep (as the OAuth sign-in does) when the password answer, OR the workspace picker's answer, asks for a second factor: six-digit code or recovery code, its own strike meter and lockout panel, Start Over back to the email step. - A proven code redirects through the same helper as the step that asked for it (redirectSignedIn / redirectChosenWorkspace, extracted unchanged), so shared-doc handoff, plan checkout, ?next=, the careers landing and the applied-job carrier all behave identically. - MfaStep: submits by itself on the sixth digit (typed or pasted) with a synchronous double-submit guard; refocuses the field after a refusal (the old timeout could fire while it was still disabled); org accent for the button and focus ring (OAuth keeps its neutral default); copy no longer names Kamo on white-label hosts. - **************** guards the wiring.